coupon.mercari.lol Open in urlscan Pro
34.146.216.235 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://coupon.mercari.lol/jp
Effective URL:
https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&...
Submission: On May 19 via manual (May 19th 2022, 12:54:04 am UTC) from JP — Scanned from JP

Summary HTTP 26 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 26 HTTP transactions. The main IP is 34.146.216.235, located in Tokyo, Japan and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is coupon.mercari.lol.
TLS certificate: Issued by R3 on May 17th 2022. Valid for: 3 months.

This is the only time coupon.mercari.lol was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Mercari (E-commerce)

Domain & IP information

	IP Address		AS Autonomous System
20	34.146.216.235 34.146.216.235		396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
26	2

20 34.146.216.235 (Tokyo, Japan)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 235.216.146.34.bc.googleusercontent.com

coupon.mercari.lol	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	mercari.lol coupon.mercari.lol	299 KB
26	1

	Domain	Requested by
20	coupon.mercari.lol	coupon.mercari.lol
26	1

This site contains no links.

Subject Issuer	Validity	Valid
coupon.mercari.lol R3	`2022-05-17` - `2022-08-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1
Frame ID: 3B25293481CD7AE170D77A384E6046F2
Requests: 26 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ログイン

Page URL History Show full URLs

https://coupon.mercari.lol/jp Page URL
https://coupon.mercari.lol/index.php?t=4580001b48ab6b65c03abbce05ccae54d34ad6a59b709439f503df3b5a36ac07 Page URL
https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&actio... Page URL

Detected technologies

Akamai Bot Manager (Security) Expand

Overall confidence: 100%
Detected patterns

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

26
Requests

77 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

299 kB
Transfer

836 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://coupon.mercari.lol/jp Page URL
https://coupon.mercari.lol/index.php?t=4580001b48ab6b65c03abbce05ccae54d34ad6a59b709439f503df3b5a36ac07 Page URL
https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

26 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 jp Show response
coupon.mercari.lol/ 1 KB
1 KB 65ms
7ms Document
text/html 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://coupon.mercari.lol/jp

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

7f3763adec2d8556fdc6c81ed2e32e7cbb8d9578d339737684f3d15d0db0bef1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
access-control-allow-origin: coupon.mercari.lol
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 597
content-security-policy: frame-ancestors 'none'
content-type: text/html; charset=UTF-8
date: Thu, 19 May 2022 00:53:59 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
upgrade-insecure-requests: 1
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H2 200 vendor.23238u92u82.js Show response
coupon.mercari.lol/vendor/ 5 KB
2 KB 5ms
5ms Script
application/javascript 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://coupon.mercari.lol/vendor/vendor.23238u92u82.js

Requested by

Host: coupon.mercari.lol
URL: https://coupon.mercari.lol/jp

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

ae9da3c9a568a7b3602dc54e10c324166db3abe1d3a6892770d6ce6a7cc8c1c6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://coupon.mercari.lol/jp
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-length: 1907
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
last-modified: Mon, 05 Apr 2021 18:24:52 GMT
server: Apache
upgrade-insecure-requests: 1
date: Thu, 19 May 2022 00:53:59 GMT
vary: Accept-Encoding
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
content-type: application/javascript
access-control-allow-origin: (null)
accept-ranges: bytes

GET
H2 200 index.php
coupon.mercari.lol/ 5 KB
3 KB 67ms
67ms Document
text/html 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://coupon.mercari.lol/index.php?t=4580001b48ab6b65c03abbce05ccae54d34ad6a59b709439f503df3b5a36ac07

Requested by

Host: coupon.mercari.lol
URL: https://coupon.mercari.lol/jp

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://coupon.mercari.lol/jp
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
access-control-allow-origin: coupon.mercari.lol
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2379
content-security-policy: frame-ancestors 'none'
content-type: text/html; charset=UTF-8
date: Thu, 19 May 2022 00:53:59 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
upgrade-insecure-requests: 1
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H2 200 Primary Request signin Show response
coupon.mercari.lol/ap/ 7 KB
2 KB 173ms
173ms Document
text/html 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1

Requested by

Host: coupon.mercari.lol
URL: https://coupon.mercari.lol/index.php?t=4580001b48ab6b65c03abbce05ccae54d34ad6a59b709439f503df3b5a36ac07

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

998b030c13d5b039c33251830d5352c4f5c668ec8ff0153d5c63a63152150752

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://coupon.mercari.lol/index.php?t=4580001b48ab6b65c03abbce05ccae54d34ad6a59b709439f503df3b5a36ac07
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
access-control-allow-origin: coupon.mercari.lol
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1973
content-security-policy: frame-ancestors 'none'
content-type: text/html; charset=UTF-8
date: Thu, 19 May 2022 00:53:59 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
upgrade-insecure-requests: 1
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H2 200 app.jp.css
coupon.mercari.lol/ap/login001/ 459 KB
57 KB 30ms
28ms Stylesheet
text/css 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://coupon.mercari.lol/ap/login001/app.jp.css

Requested by

Host: coupon.mercari.lol
URL: https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

89b3b39710cd73bb5e4cfa622c27f54bd215477ac2711c0bc5701c6352d73f53

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-length: 57984
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
last-modified: Wed, 18 May 2022 19:57:16 GMT
server: Apache
upgrade-insecure-requests: 1
date: Thu, 19 May 2022 00:53:59 GMT
vary: Accept-Encoding
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
content-type: text/css
access-control-allow-origin: (null)
accept-ranges: bytes

GET
H2 200 jquery-3.6.0.min.js.%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89 Show response
coupon.mercari.lol/ap/login001/ 87 KB
30 KB 32ms
29ms Script
application/javascript 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://coupon.mercari.lol/ap/login001/jquery-3.6.0.min.js.%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1
Origin: https://coupon.mercari.lol
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-length: 30902
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
last-modified: Sat, 14 May 2022 18:01:45 GMT
server: Apache
upgrade-insecure-requests: 1
date: Thu, 19 May 2022 00:53:59 GMT
vary: Accept-Encoding
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
content-type: application/javascript
access-control-allow-origin: (null)
accept-ranges: bytes

GET
H2 200 site-jquery.min.js.%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89 Show response
coupon.mercari.lol/ap/login001/ 91 KB
32 KB 24ms
22ms Script
application/javascript 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://coupon.mercari.lol/ap/login001/site-jquery.min.js.%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

5994332aadd364a7350ad226ef61c1c75dc97372f739e01682e190be3abaf672

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-length: 32817
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
last-modified: Sat, 14 May 2022 18:01:43 GMT
server: Apache
upgrade-insecure-requests: 1
date: Thu, 19 May 2022 00:53:59 GMT
vary: Accept-Encoding
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
content-type: application/javascript
access-control-allow-origin: (null)
accept-ranges: bytes

GET layer.js.%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89
coupon.mercari.lol/ap/login001/ 0
0

GET layer.min.js.%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89
coupon.mercari.lol/ap/login001/ 0
0

GET loading-2.gif
coupon.mercari.lol/ap/login001/ 0
0

GET
H2 200 layer.css
coupon.mercari.lol/ap/login001/ 14 KB
3 KB 10ms
9ms Stylesheet
text/css 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://coupon.mercari.lol/ap/login001/layer.css

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

e3144d018a6a24f733c6fc2a2ee603fb583f0030585e9d4b71bec471b78e31fc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-length: 2812
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
last-modified: Sat, 14 May 2022 18:01:45 GMT
server: Apache
upgrade-insecure-requests: 1
date: Thu, 19 May 2022 00:53:59 GMT
vary: Accept-Encoding
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
content-type: text/css
access-control-allow-origin: (null)
accept-ranges: bytes

GET
H2 200 logo_login.svg
coupon.mercari.lol/ap/login001/ 2 KB
1 KB 5ms
5ms Image
image/svg+xml 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://coupon.mercari.lol/ap/login001/logo_login.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

f4c823301da0441f633837b7b207f4711269ff5c49e8d82f66df3324031a30cc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-length: 1120
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
last-modified: Sat, 14 May 2022 18:01:42 GMT
server: Apache
upgrade-insecure-requests: 1
date: Thu, 19 May 2022 00:53:59 GMT
vary: Accept-Encoding
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
content-type: image/svg+xml
access-control-allow-origin: (null)
accept-ranges: bytes

GET
H2 200 mailout.png
coupon.mercari.lol/ap/login001/ 163 KB
165 KB 4ms
4ms Image
image/png 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://coupon.mercari.lol/ap/login001/mailout.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

71172f258326e9931a3ba83ccf7cfe10d9b357bc76c8c4b04029db20c3b4d997

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
x-content-type-options: nosniff
last-modified: Sat, 14 May 2022 18:01:43 GMT
server: Apache
upgrade-insecure-requests: 1
date: Thu, 19 May 2022 00:53:59 GMT
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
content-type: image/png
access-control-allow-origin: (null)
accept-ranges: bytes
x-dns-prefetch-control: off
content-length: 167284
x-xss-protection: 1; mode=block

GET
H2 200 gg.png
coupon.mercari.lol/ap/login001/ 609 B
670 B 4ms
4ms Image
image/png 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://coupon.mercari.lol/ap/login001/gg.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

6192797f51f52a5a6928375536a1ce33afe8150255fd69f8e99eb503b40202ff

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
x-content-type-options: nosniff
last-modified: Wed, 18 May 2022 13:28:38 GMT
server: Apache
upgrade-insecure-requests: 1
date: Thu, 19 May 2022 00:53:59 GMT
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
content-type: image/png
access-control-allow-origin: (null)
accept-ranges: bytes
x-dns-prefetch-control: off
content-length: 609
x-xss-protection: 1; mode=block

GET
H2 200 Facebook.png
coupon.mercari.lol/ap/login001/ 474 B
535 B 5ms
5ms Image
image/png 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://coupon.mercari.lol/ap/login001/Facebook.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

432aead32eb725b42325a1ae3063839ba1b3cf78207f0199b43aeabdd4ec55f7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
x-content-type-options: nosniff
last-modified: Wed, 18 May 2022 13:42:02 GMT
server: Apache
upgrade-insecure-requests: 1
date: Thu, 19 May 2022 00:53:59 GMT
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
content-type: image/png
access-control-allow-origin: (null)
accept-ranges: bytes
x-dns-prefetch-control: off
content-length: 474
x-xss-protection: 1; mode=block

GET
H2 200 apple.png
coupon.mercari.lol/ap/login001/ 512 B
572 B 5ms
5ms Image
image/png 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://coupon.mercari.lol/ap/login001/apple.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

710af163fbc86ed27b4012f2df34df1efc19ef7b24875f3a7fa776b4cd48fcbc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
x-content-type-options: nosniff
last-modified: Sat, 14 May 2022 18:01:44 GMT
server: Apache
upgrade-insecure-requests: 1
date: Thu, 19 May 2022 00:53:59 GMT
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
content-type: image/png
access-control-allow-origin: (null)
accept-ranges: bytes
x-dns-prefetch-control: off
content-length: 512
x-xss-protection: 1; mode=block

GET
H2 404 blocker13.js.%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89
coupon.mercari.lol/ap/login001/ 0
0 5ms
4ms Script
text/html 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://coupon.mercari.lol/ap/login001/blocker13.js.%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
x-content-type-options: nosniff
server: Apache
upgrade-insecure-requests: 1
date: Thu, 19 May 2022 00:53:59 GMT
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
content-type: text/html; charset=iso-8859-1
access-control-allow-origin: (null)
x-dns-prefetch-control: off
content-length: 265
x-xss-protection: 1; mode=block

GET layer.js.%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89
coupon.mercari.lol/ap/login001/ 0
0

GET layer.min.js.%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89
coupon.mercari.lol/ap/login001/ 0
0

GET loading-2.gif
coupon.mercari.lol/ap/login001/ 0
0

GET
H2 404 google.svg
coupon.mercari.lol/ap/img/ 265 B
265 B 4ms
4ms Image
text/html 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://coupon.mercari.lol/ap/img/google.svg

Requested by

Host: coupon.mercari.lol
URL: https://coupon.mercari.lol/ap/login001/app.jp.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

a425ecbf86d9df8876546099e68e7b9fb3059cc94b8a77e335acb23a7442bccf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://coupon.mercari.lol/ap/login001/app.jp.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
x-content-type-options: nosniff
server: Apache
upgrade-insecure-requests: 1
date: Thu, 19 May 2022 00:53:59 GMT
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
content-type: text/html; charset=iso-8859-1
access-control-allow-origin: (null)
x-dns-prefetch-control: off
content-length: 265
x-xss-protection: 1; mode=block

GET
H2 404 SourceSansPro-Semibold.ttf.woff2
coupon.mercari.lol/jp/assets/fonts/ 0
0 4ms
4ms Font
text/html 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://coupon.mercari.lol/jp/assets/fonts/SourceSansPro-Semibold.ttf.woff2?52591824

Requested by

Host: coupon.mercari.lol
URL: https://coupon.mercari.lol/ap/login001/app.jp.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://coupon.mercari.lol/ap/login001/app.jp.css
Origin: https://coupon.mercari.lol
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
x-content-type-options: nosniff
server: Apache
upgrade-insecure-requests: 1
date: Thu, 19 May 2022 00:53:59 GMT
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
content-type: text/html; charset=iso-8859-1
access-control-allow-origin: (null)
x-dns-prefetch-control: off
content-length: 265
x-xss-protection: 1; mode=block

GET
H2 404 SourceSansPro-Regular.ttf.woff2
coupon.mercari.lol/jp/assets/fonts/ 0
0 4ms
4ms Font
text/html 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://coupon.mercari.lol/jp/assets/fonts/SourceSansPro-Regular.ttf.woff2?52591824

Requested by

Host: coupon.mercari.lol
URL: https://coupon.mercari.lol/ap/login001/app.jp.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://coupon.mercari.lol/ap/login001/app.jp.css
Origin: https://coupon.mercari.lol
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
x-content-type-options: nosniff
server: Apache
upgrade-insecure-requests: 1
date: Thu, 19 May 2022 00:53:59 GMT
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
content-type: text/html; charset=iso-8859-1
access-control-allow-origin: (null)
x-dns-prefetch-control: off
content-length: 265
x-xss-protection: 1; mode=block

GET
H2 404 SourceSansPro-Semibold.otf.woff
coupon.mercari.lol/jp/assets/fonts/ 0
0 4ms
4ms Font
text/html 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://coupon.mercari.lol/jp/assets/fonts/SourceSansPro-Semibold.otf.woff?52591824

Requested by

Host: coupon.mercari.lol
URL: https://coupon.mercari.lol/ap/login001/app.jp.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://coupon.mercari.lol/ap/login001/app.jp.css
Origin: https://coupon.mercari.lol
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
x-content-type-options: nosniff
server: Apache
upgrade-insecure-requests: 1
date: Thu, 19 May 2022 00:54:00 GMT
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
content-type: text/html; charset=iso-8859-1
access-control-allow-origin: (null)
x-dns-prefetch-control: off
content-length: 265
x-xss-protection: 1; mode=block

GET
H2 404 SourceSansPro-Regular.otf.woff
coupon.mercari.lol/jp/assets/fonts/ 0
0 4ms
3ms Font
text/html 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://coupon.mercari.lol/jp/assets/fonts/SourceSansPro-Regular.otf.woff?52591824

Requested by

Host: coupon.mercari.lol
URL: https://coupon.mercari.lol/ap/login001/app.jp.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://coupon.mercari.lol/ap/login001/app.jp.css
Origin: https://coupon.mercari.lol
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
x-content-type-options: nosniff
server: Apache
upgrade-insecure-requests: 1
date: Thu, 19 May 2022 00:54:00 GMT
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
content-type: text/html; charset=iso-8859-1
access-control-allow-origin: (null)
x-dns-prefetch-control: off
content-length: 265
x-xss-protection: 1; mode=block

GET
H2 404 SourceSansPro-Regular.ttf
coupon.mercari.lol/jp/assets/fonts/ 0
0 4ms
4ms Font
text/html 34.146.216.235
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://coupon.mercari.lol/jp/assets/fonts/SourceSansPro-Regular.ttf?52591824

Requested by

Host: coupon.mercari.lol
URL: https://coupon.mercari.lol/ap/login001/app.jp.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.146.216.235 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

235.216.146.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://coupon.mercari.lol/ap/login001/app.jp.css
Origin: https://coupon.mercari.lol
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
x-content-type-options: nosniff
server: Apache
upgrade-insecure-requests: 1
date: Thu, 19 May 2022 00:54:00 GMT
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE
content-type: text/html; charset=iso-8859-1
access-control-allow-origin: (null)
x-dns-prefetch-control: off
content-length: 265
x-xss-protection: 1; mode=block

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: coupon.mercari.lol
URL: https://coupon.mercari.lol/ap/login001/layer.js.%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89

Domain: coupon.mercari.lol
URL: https://coupon.mercari.lol/ap/login001/layer.min.js.%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89

Domain: coupon.mercari.lol
URL: https://coupon.mercari.lol/ap/login001/loading-2.gif

Domain: coupon.mercari.lol
URL: https://coupon.mercari.lol/ap/login001/layer.js.%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89

Domain: coupon.mercari.lol
URL: https://coupon.mercari.lol/ap/login001/layer.min.js.%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89

Domain: coupon.mercari.lol
URL: https://coupon.mercari.lol/ap/login001/loading-2.gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Mercari (E-commerce)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
coupon.mercari.lol/	1969-12-31 23:59:59	Name: PHPSESSID Value: rd4r7og0a6dv27e6075v2it7lm
.coupon.mercari.lol/	1970-01-20 03:08:43	Name: 62345ba76168db0033ce8ae6a90ce5a762956614 Value: nwcMGFHjQc7nDOZDxhWlbg%3D%3D
.coupon.mercari.lol/	1970-01-20 03:08:43	Name: ak_bmsc Value: 4zeEvajla5VXwOLAS9VKljbM%2Fm7a2PPxUnzaTYo7SYjualh%2FgmjcSBx8TAWBybrdKQTrAU3bQQan2pU71PPsdR9wzJMdXXygEzRthO%2F2KNS8RqYSi2nWknnFPHa7E7Hofpkl6cMC%2FnKMmRI84jlPQC9vthHAjrWNB98fPsSF4YOWPe8N%2BhU7g%2FbkUvsYOv1vfOQTzftAmGgK3l%2FPcCQAjJOlP%2Fvb6cOlJbYpgn57CXX9bl1tgeiLUyuq%2Fe0IQ6PKROcFT8BHQ3OsKNTDuvuS6iVaoli5pFGdyXVUB88y%2BGKVgYE2Ew3GrfnwGLFpOCnQomHwAVC3H%2BKVgpjIwUrZO7vW2Fy4mj%2Bw3fYtfb0yHGiAJ2PLSCwTQY6L9cL%2BUOB%2FP58lzNrjNR7jKlGJyAei6p71egM2N0X6x0rxHvtXQN5HzeBf3TvLPvdMJ8A%2Byf6FOfL8OCOFXhLoNsfx6K8CCLkZ5rVCHNkYIxDg1Yj2PnwDBS37uka1XC%2F3D5pEt%2BN0%2BdtKjSaK3Cz1w7PAI5u2tiemTgQoIWtKKZDs7mrEV36WkVYanNJFEVWy%2FUY%2FDAIh3GXmpunvmUOcoTJtPttbIA4BpWpQWzSSokMRhysj%2F%2FzZmVrIhtChcOGnZonZ9Wmv1sEhIU5Z5HA0aIo5ovdYoKK0sonLqhloKU0gMkNjH%2BTlI98t4kmujt%2F0ijUkkH1EFUS1%2F968iGGE21Ke3ZdjFx81CxNb8wtOlKFr3Kp%2BKfY%3D
.coupon.mercari.lol/	1970-01-20 03:08:43	Name: _amkc Value: 11a32074-f4e3-4b4b-ab4c-b7ed0597f0af

13 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1 Message: Refused to apply style from 'https://coupon.mercari.lol/ap/login001/layer.js.%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89' because its MIME type ('application/javascript') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
security	error	URL: https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1 Message: Refused to apply style from 'https://coupon.mercari.lol/ap/login001/layer.min.js.%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89' because its MIME type ('application/javascript') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
security	error	URL: https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1 Message: Refused to apply style from 'https://coupon.mercari.lol/ap/login001/loading-2.gif' because its MIME type ('image/gif') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
network	error	URL: https://coupon.mercari.lol/ap/login001/blocker13.js.%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89 Message: Failed to load resource: the server responded with a status of 404 ()
security	error	URL: https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1 Message: Refused to apply style from 'https://coupon.mercari.lol/ap/login001/layer.min.js.%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89' because its MIME type ('application/javascript') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
security	error	URL: https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1 Message: Refused to apply style from 'https://coupon.mercari.lol/ap/login001/loading-2.gif' because its MIME type ('image/gif') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
security	error	URL: https://coupon.mercari.lol/ap/signin?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1 Message: Refused to apply style from 'https://coupon.mercari.lol/ap/login001/layer.js.%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89' because its MIME type ('application/javascript') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
network	error	URL: https://coupon.mercari.lol/ap/img/google.svg Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://coupon.mercari.lol/jp/assets/fonts/SourceSansPro-Semibold.ttf.woff2?52591824 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://coupon.mercari.lol/jp/assets/fonts/SourceSansPro-Regular.ttf.woff2?52591824 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://coupon.mercari.lol/jp/assets/fonts/SourceSansPro-Regular.otf.woff?52591824 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://coupon.mercari.lol/jp/assets/fonts/SourceSansPro-Semibold.otf.woff?52591824 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://coupon.mercari.lol/jp/assets/fonts/SourceSansPro-Regular.ttf?52591824 Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

coupon.mercari.lol
coupon.mercari.lol
34.146.216.235
432aead32eb725b42325a1ae3063839ba1b3cf78207f0199b43aeabdd4ec55f7
5994332aadd364a7350ad226ef61c1c75dc97372f739e01682e190be3abaf672
6192797f51f52a5a6928375536a1ce33afe8150255fd69f8e99eb503b40202ff
710af163fbc86ed27b4012f2df34df1efc19ef7b24875f3a7fa776b4cd48fcbc
71172f258326e9931a3ba83ccf7cfe10d9b357bc76c8c4b04029db20c3b4d997
7f3763adec2d8556fdc6c81ed2e32e7cbb8d9578d339737684f3d15d0db0bef1
89b3b39710cd73bb5e4cfa622c27f54bd215477ac2711c0bc5701c6352d73f53
998b030c13d5b039c33251830d5352c4f5c668ec8ff0153d5c63a63152150752
a425ecbf86d9df8876546099e68e7b9fb3059cc94b8a77e335acb23a7442bccf
ae9da3c9a568a7b3602dc54e10c324166db3abe1d3a6892770d6ce6a7cc8c1c6
e3144d018a6a24f733c6fc2a2ee603fb583f0030585e9d4b71bec471b78e31fc
f4c823301da0441f633837b7b207f4711269ff5c49e8d82f66df3324031a30cc
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

coupon.mercari.lol Open in urlscan Pro 34.146.216.235 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

26 Requests

77 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

299 kBTransfer

836 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

26 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

4 Cookies

13 Console Messages

Security Headers

Indicators

coupon.mercari.lol Open in urlscan Pro
34.146.216.235 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

26
Requests

77 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

299 kB
Transfer

836 kB
Size

4
Cookies

26 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!